✨ Add support for AMD SEV-SNP instances #5605
Conversation
k8s-ci-robot
added
kind/feature
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
needs-priority
needs-ok-to-test
|
Hi @fangge1212. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
the
size/L
fangge1212
force-pushed
the
amd_sev_snp_1
branch
3 times, most recently
from
934e570 to
3a228e8
Compare
fangge1212
force-pushed
the
amd_sev_snp_1
branch
from
3a228e8 to
94d842c
Compare
There was a problem hiding this comment.
Thanks a lot for the PR @fangge1212
I left a comment about a pattern to follow for the API types
api/v1beta2/awsmachine_types.go
Outdated
| // AWSConfidentialComputePolicy represents the confidential compute configuration for the instance. | ||
| // +kubebuilder:validation:Enum=Disabled;AmdSevSnp | ||
| type AWSConfidentialComputePolicy string | ||
|
|
||
| const ( | ||
| // AWSConfidentialComputePolicyNone disables confidential computing for the instance. | ||
| AWSConfidentialComputePolicyNone AWSConfidentialComputePolicy = "None" | ||
| // AWSConfidentialComputePolicySEVSNP enables AMD SEV-SNP as the confidential computing technology for the instance. | ||
| AWSConfidentialComputePolicySEVSNP AWSConfidentialComputePolicy = "AmdSevSnp" | ||
| ) | ||
|
|
||
| // CPUOptions defines CPU-related settings for the instance, including the confidential computing policy. | ||
| // +kubebuilder:validation:MinProperties=1 | ||
| type CPUOptions struct { | ||
| // confidentialCompute specifies whether confidential computing should be enabled for the instance, | ||
| // and, if so, which confidential computing technology to use. | ||
| // Valid values are: None, AmdSev | ||
| // When set to None, confidential computing will be disabled for the instance. | ||
| // When set to AmdSevSnp, AMD SEV-SNP will be used as the confidential computing technology for the instance. | ||
| // In this case, ensure the following conditions are met: | ||
| // 1) The selected instance type supports AMD SEV-SNP. | ||
| // 2) The selected AWS region supports AMD SEV-SNP. | ||
| // 3) The selected AMI supports AMD SEV-SNP. | ||
| // More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html | ||
| // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change without notice. The current default is Disabled. | ||
| // +optional | ||
| ConfidentialCompute AWSConfidentialComputePolicy `json:"confidentialCompute,omitempty"` | ||
| } | ||
|
|
There was a problem hiding this comment.
Let's follow this pattern for types and constant names, which contains best practices in terms of API design: https://github.com/openshift/api/pull/2165/files#diff-9bd66f01f63b7ce0455fe993aa03dfe93964ac62b31278a6dbf3db2fcb7f792eR58-R168
There was a problem hiding this comment.
Hi Damiano
I did refer to the PR you mentioned when working on this one. I went with AWSConfidentialComputePolicyNone based on @everettraven’s advice in this discussion: openshift/api#2424 (comment). Could you please point out the exact changes you’d like so I can make sure it fully follows the API design best practices you’re referring to?
There was a problem hiding this comment.
Ah I see. I left a comment there, let's then use the same approach we decide on there, also here, thanks @fangge1212
k8s-ci-robot
added
the
needs-rebase
fangge1212
force-pushed
the
amd_sev_snp_1
branch
from
94d842c to
26158f1
Compare
k8s-ci-robot
removed
the
needs-rebase
fangge1212
force-pushed
the
amd_sev_snp_1
branch
2 times, most recently
from
083ec14 to
ae22824
Compare
This commit adds support for AMD SEV-SNP instances, so users can utilize confidential computing technology on cluster nodes. Signed-off-by: Fangge Jin <[email protected]>
fangge1212
force-pushed
the
amd_sev_snp_1
branch
from
ae22824 to
80bf0a3
Compare
|
PR needs rebase. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
the
needs-rebase
This is another version of #5598
Differences:
What type of PR is this?
/kind feature
What this PR does / why we need it:
Special notes for your reviewer:
Checklist:
Release note: